hermes-agent

ouyangbo/hermes-agent

Fork 0

Commit Graph

Author	SHA1	Message	Date
teknium1	48763a4d01	docs(plugin-catalog): replace the 2-week pin-maturity rule with a no-self-updater rule, enforced in CI Teknium's ruling: catalog plugins do not need the 2-week maturity window, but they may not ship an in-app updater that downloads and replaces their own files, because that makes the reviewed SHA pin decorative. Rule 3 in the README and item 5 on the docs page now say so, and plugin-catalog-ci fails an entry whose catalog build both fetches from GitHub releases/raw and writes or renames plugin files (either half alone is allowed).	2026-09-14 17:17:19 -07:00
Teknium	ce6d9e62cd	fix(catalog): reconcile catalog layer with landed index/manifest-v2/portable tracks - cmd_install: curated catalog resolution first, community-index fallback with unreviewed warning - _install_plugin_core: removed-blocklist gate on top of main pinned-metadata installer - cmd_update: catalog sidecar re-pins to catalog SHA (never git pull) - validator: config_schema (v2) shape check; portable Agent Plugins v1 plugin.json admission - admission CI: accept plugin.json-only packages at the pinned SHA - cmd_list: catalog:<tier>@<sha> provenance + removed annotations (table + JSON)	2026-08-27 21:37:16 -07:00
Teknium	8dd07bd517	feat(ci): plugin-validate reusable action + plugin-catalog admission gate - scripts/validate_plugin_catalog.py: standalone stdlib+pyyaml structural validator for plugin-catalog entries and removed.yaml (no hermes install needed; runtime twin of hermes_cli/plugin_catalog.py). --json support, unknown top-level keys warn instead of failing for forward compat. - .github/actions/plugin-validate: composite action plugin authors drop into their own repo's CI — installs hermes-agent from a chosen ref and runs 'hermes plugins validate <path>'. - .github/workflows/plugin-catalog-ci.yml: admission gate on PRs touching plugin-catalog/** — structural job plus pinned-source job that clones each changed entry's repo, hard-fails on unreachable pinned sha (supply-chain gate), and validates the plugin at that exact commit.	2026-07-22 07:22:43 -07:00

Author

SHA1

Message

Date

teknium1

48763a4d01

docs(plugin-catalog): replace the 2-week pin-maturity rule with a no-self-updater rule, enforced in CI

Teknium's ruling: catalog plugins do not need the 2-week maturity window,
but they may not ship an in-app updater that downloads and replaces their
own files, because that makes the reviewed SHA pin decorative. Rule 3 in
the README and item 5 on the docs page now say so, and plugin-catalog-ci
fails an entry whose catalog build both fetches from GitHub releases/raw
and writes or renames plugin files (either half alone is allowed).

2026-09-14 17:17:19 -07:00

Teknium

ce6d9e62cd

fix(catalog): reconcile catalog layer with landed index/manifest-v2/portable tracks

- cmd_install: curated catalog resolution first, community-index fallback with unreviewed warning
- _install_plugin_core: removed-blocklist gate on top of main pinned-metadata installer
- cmd_update: catalog sidecar re-pins to catalog SHA (never git pull)
- validator: config_schema (v2) shape check; portable Agent Plugins v1 plugin.json admission
- admission CI: accept plugin.json-only packages at the pinned SHA
- cmd_list: catalog:<tier>@<sha> provenance + removed annotations (table + JSON)

2026-08-27 21:37:16 -07:00

Teknium

8dd07bd517

feat(ci): plugin-validate reusable action + plugin-catalog admission gate

- scripts/validate_plugin_catalog.py: standalone stdlib+pyyaml structural
  validator for plugin-catalog entries and removed.yaml (no hermes install
  needed; runtime twin of hermes_cli/plugin_catalog.py). --json support,
  unknown top-level keys warn instead of failing for forward compat.
- .github/actions/plugin-validate: composite action plugin authors drop
  into their own repo's CI — installs hermes-agent from a chosen ref and
  runs 'hermes plugins validate <path>'.
- .github/workflows/plugin-catalog-ci.yml: admission gate on PRs touching
  plugin-catalog/** — structural job plus pinned-source job that clones
  each changed entry's repo, hard-fails on unreachable pinned sha
  (supply-chain gate), and validates the plugin at that exact commit.

2026-07-22 07:22:43 -07:00

3 Commits